Target must face a mass consumer lawsuit accusing the retailer of failing to protect shoppers from hackers who stole charge-card data and other personal information during last year’s holiday shopping season.

A federal judge Friday denied Target’s bid to dismiss the case, allowing the bulk of the claims to move forward. As many as 110 million people were affected, according to the company, although there may be some overlap between those whose card data was stolen and those whose personal information was taken.

At the same time, office-supply retailer Staples said about 1.16 million payment cards might have been affected by the data breach announced in October.

An investigation by external data security experts showed that criminals deployed malware to some point-of-sales systems at 115 US stores, Staples said.